Run Network Monitor at the Mirror Port
One of the most frequently questions asked is "How can I see all of the subnet traffic using Network Monitor?". The most efficient way to do this is to attach your computer's ethernet connection directly to the "Mirror" port on your switch. On Cisco switches the mirroring port is called the SPAN port (see Switched Port Analyzer). Almost all switches today come with one of these ports to allow system administrators to analyze network traffic using a packet sniffing product like Distinct Network Monitor.
Why do you need to attach to the mirror port? Well, technically when a NIC driver is in promiscuous mode, it is able to see all of the traffic that is travelling on the wire it is attached to. However, that traffic may be in fact limited to its own traffic and subnet broadcast traffic in the case of a switched network. As an administrator, the most efficient way for you to analyze traffic that is not visible from your computer is to capture it using the mirror or SPAN port on your switch.
When this is not possible Distinct Network Monitor does offer one more option through its Agents. Using Agents you will be able to analyze traffic that is not visible from your computer.
|
|
|
Do you know a friend or colleague who
might be interested in this product?
|
